Remote copy system and method of deciding recovery point objective in remote copy system

ABSTRACT

A remote copy system comprises a primary storage system having a primary volume, and a secondary storage system having a secondary volume forming a pair relationship with the primary volume. When the primary storage system receives a write command from a primary host computer, it stores the command in the primary volume and creates a journal added with time information. The secondary storage system receives the journal from the primary storage system and updates the secondary volume based on the received journal. The primary host computer determines, based on the operating status of the secondary storage system, either the time added to the latest journal that the secondary storage system received or the time added to the latest journal that updated the secondary volume as the recovery point objective, and provides the determined time this to the user.

CROSS-REFERENCES

This application relates to and claims priority from Japanese PatentApplication No. 2008-031540, filed on Feb. 13, 2008, the entiredisclosure of which is incorporated herein by reference.

BACKGROUND

The present invention generally relates to a remote copy system, andparticularly relates to a remote copy system that copies data betweenstorage systems located respectively at two remote sites.

In recent years, the importance of corporate information systems and thedata used therein is increasing, and disaster recovery technology forrecovering data in computer systems that failed due to a disaster or thelike is attracting attention. A remote copy system is known asrepresentative technology for performing disaster recovery.

For instance, Japanese Patent Laid-Open Publication No. 2005-18506(Patent Document 1) discloses technology where a storage system receivesdata sent from a host computer and writes the data in its own storageapparatus, and also transfers such data to another storage systempositioned in a physically remote location in order to store the data.

More specifically, this technology relates to a computer system having aprimary host computer and a primary storage system connected thereto ata primary site, and a secondary host computer and a secondary storagesystem connected thereto at a secondary site that is located remotelyfrom the primary site. When the primary storage system receives datawith a creation timestamp from the primary host computer, it writes thedata in its own volume, and further writes the data and its timestamp asa journal in its own journal volume. The secondary storage system readsthe journal in the primary storage system, and temporarily stores thedata with the timestamp in a journal volume of the secondary storagesystem in the same update sequence as the volumes of the primary storagesystem. The secondary storage system then retrieves the data from thejournal volume and writes it into the volume. With this computer system,if a failure occurs in the primary site or in a communication linebetween the primary storage system and the secondary storage system, thejournals stored in the journal volume that the secondary storage systemreceived before the failure are reflected in the copy destination volumeof the secondary storage system. As a result of adopting this kind ofconfiguration, even if an active computer system encounters a disasterand is subject to a system failure, the data copied to a storage systempositioned at a physically remote location can be used to recover thecomputer system in a relatively short period of time.

With the technology described in Patent Document 1, the time pertainingto the journal that was last reflected in the secondary volume is set asthe recovery point objective (RPO). The set recovery point objective ispresented to the user of a computer system at the time of recovery, butthere is a problem in that such time cannot necessarily be used as avalid recovery point objective.

More specifically, journals that have not yet been reflected in thesecondary volume among the journals that the secondary storage systemreceived can be reflected in the secondary volume while maintaining thesame update sequence as the primary volume even after a failure occursin the primary site or in the communication line between the primarysite and the secondary site. Thus, although the time pertaining to thejournal that was last reflected in the secondary volume immediatelybefore the occurrence of a failure should be set as the recovery pointobjective under normal circumstances, there are cases where the journalsthat have already been received by the secondary storage system aresubsequently reflected in the secondary volume, and the time pertainingto the journal that was reflected after the occurrence of a failure isset as the recovery point objective.

Further, if the latest time among the time pertaining to the journalsthat the secondary storage system received is deemed to be the recoverypoint objective, there are cases where such time is invalidated due to afailure occurring in the secondary journal volume or the remote copybeing temporarily suspended.

Such an inaccurate recovery point objective will cause the loss of data,and it may not be possible to recover the computer system to itscomplete original conditions.

In addition, the user of a computer system must constantly determinewhether the presented recovery point objective is valid or invalid, andwas excessively burdened with recovery operations.

SUMMARY

In light of the foregoing problems, an object of the present inventionis to provide a remote copy system capable of presenting a more accuraterecovery point objective to the user of a computer system.

In order to achieve the foregoing object, according to one aspect of thepresent invention, provided is a remote copy system comprising a firsthost computer, a first storage system operatively connected to the firsthost computer and including a first volume, a second host computer, anda second storage system operatively connected to the second hostcomputer and the first storage system, and including a second volumeforming a pair relationship with the first volume. When the firststorage system receives a write command from the first host computer,the first storage system stores data accompanied with the write commandin the first volume, and creates journal data to which time informationis added based on the write command. The second storage system receivesthe created journal data from the first storage system, and updates thesecond volume based on the received journal data. The first hostcomputer acquires, based on the operating status of the second storagesystem, either latest time information among the time information addedto the journal that the second storage system received or latest timeinformation among the time information added to the journal data thatupdated the second volume.

According to the present invention, a valid recovery point objective canbe obtained according to the operating status of the storage system, andit is thereby possible to realize an accurate recovery. In addition, theuser of a computer system is not required to decide a valid recoverypoint objective by giving consideration to the operating status of thestorage system, and it is thereby possible to alleviate the user'sburden during the recovery operation.

DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram showing an overall configuration of a remote copysystem according to an embodiment of the present invention;

FIG. 2 is a diagram explaining a configuration of a primary hostcomputer of a remote copy system according to an embodiment of thepresent invention;

FIG. 3 is a diagram explaining the contents of a memory 201 of theprimary host computer of a remote copy system according to an embodimentof the present invention;

FIG. 4 is a diagram showing an exemplary volume definition tableretained in a host computer of a remote copy system according to anembodiment of the present invention;

FIG. 5 is a diagram showing an exemplary copy group definition tableretained in a host computer of a remote copy system according to anembodiment of the present invention;

FIG. 6 is a diagram showing an exemplary command device definition tableretained in a host computer of a remote copy system according to anembodiment of the present invention;

FIG. 7 is a diagram showing an exemplary path definition table retainedin a host computer of a remote copy system according to an embodiment ofthe present invention;

FIG. 8 is a diagram showing an exemplary copy group management tableretained in a host computer of a remote copy system according to anembodiment of the present invention;

FIG. 9 is a diagram showing a configuration of a primary storage systemin a remote copy system according to an embodiment of the presentinvention;

FIG. 10 is a diagram showing a configuration of a copy processingprogram of a storage system according to an embodiment of the presentinvention;

FIG. 11A is a diagram showing a primary journal volume retained in astorage system of a remote copy system according to an embodiment of thepresent invention;

FIG. 11B is a diagram showing an example of a journal management tableof a primary journal volume in a remote copy system according to anembodiment of the present invention;

FIG. 12 is a diagram showing a copy management table retained in astorage system of a remote copy system according to an embodiment of thepresent invention;

FIG. 13 is a diagram showing a journal volume management table retainedin a storage system of a remote copy system according to an embodimentof the present invention;

FIG. 14A is a diagram showing an example of an I/O command format to beused in a remote copy system according to an embodiment of the presentinvention;

FIG. 14B is a diagram showing an example of an I/O command format to beused in a remote copy system according to an embodiment of the presentinvention;

FIG. 14C is a diagram showing an example of an I/O command format to beused in a remote copy system according to an embodiment of the presentinvention;

FIG. 14D is a diagram showing an example of an I/O command format to beused in a remote copy system according to an embodiment of the presentinvention;

FIG. 14E is a diagram showing an example of an I/O command format to beused in a remote copy system according to an embodiment of the presentinvention;

FIG. 14F is a diagram showing an example of an I/O command format to beused in a remote copy system according to an embodiment of the presentinvention;

FIG. 15 is a diagram explaining a pair status table in a remote copysystem according to an embodiment of the present invention;

FIG. 16 is a flowchart explaining pair creation processing in the remotecopy system according to an embodiment of the present invention;

FIG. 17 is a flowchart explaining copy suspension processing in a remotecopy system according to an embodiment of the present invention;

FIG. 18 is a flowchart explaining copy resumption processing in a remotecopy system according to an embodiment of the present invention;

FIG. 19 is a flowchart explaining copy deletion processing in a remotecopy system according to an embodiment of the present invention;

FIG. 20A is a flowchart explaining pair status acquisition processing ina remote copy system according to an embodiment of the presentinvention;

FIG. 20B is a flowchart explaining consistency time setting processingin a remote copy system according to an embodiment of the presentinvention;

FIG. 20C is a flowchart explaining copy group management table settingprocessing in a remote copy system according to an embodiment of thepresent invention;

FIG. 21A is a flowchart explaining failure-detected processing in aremote copy system according to an embodiment of the present invention;

FIG. 21B is a flowchart explaining failure-detected processing in aremote copy system according to an embodiment of the present invention;

FIG. 22 is a flowchart explaining write processing in a remote copysystem according to an embodiment of the present invention;

FIG. 23 is a diagram showing an example of a pair status table in aremote copy system according to an embodiment of the present invention;

FIG. 24 is a flowchart explaining consistency time setting processing ina remote copy system according to an embodiment of the presentinvention;

FIG. 25 is a flowchart explaining copy group management table settingprocessing in a remote copy system according to an embodiment of thepresent invention;

FIG. 26 is a flowchart explaining consistency time setting processing ina remote copy system according to an embodiment of the presentinvention;

FIG. 27 is a diagram showing a configuration of a storage managementprogram in a host computer according to an embodiment of the presentinvention;

FIG. 28 is a diagram explaining copy pair statuses in a remote copysystem according to an embodiment of the present invention;

FIG. 29 is a diagram explaining copy group operation in a remote copysystem according to an embodiment of the present invention;

FIG. 30 is a diagram explaining remote copy processing in a remote copysystem according to an embodiment of the present invention;

FIG. 31A is a diagram showing an example of a copy group definitiontable of a host computer in the remote copy system according to anembodiment of the present invention;

FIG. 31B is a diagram showing an example of a journal volume managementtable of a primary storage system in a remote copy system according toan embodiment of the present invention;

FIG. 31C is a diagram showing an example of a journal volume managementtable of a secondary storage system in a remote copy system according toan embodiment of the present invention;

FIG. 32 is a diagram showing in a time series an example of operationperformed to a copy group set in a remote copy system according to anembodiment of the present invention;

FIG. 33A is a diagram showing contents of a copy management table at thepoint in time when pair status acquisition processing is executed at acertain time in a remote copy system according to an embodiment of thepresent invention;

FIG. 33B is a diagram showing contents of a journal volume managementtable of a primary storage system at the point in time when pair statusacquisition processing is executed at a certain time in the remote copysystem according to an embodiment of the present invention;

FIG. 33C is a diagram showing contents of a journal volume managementtable of a secondary storage system at the point in time when pairstatus acquisition processing is executed at a certain time in a remotecopy system according to an embodiment of the present invention;

FIG. 33D is a diagram showing contents of a pair status table at thepoint in time when pair status acquisition processing is executed at acertain time in a remote copy system according to an embodiment of thepresent invention;

FIG. 34A is a diagram showing contents of a copy management table at thepoint in time when pair status acquisition processing is executed at acertain time in a remote copy system according to an embodiment of thepresent invention;

FIG. 34B is a diagram showing contents of a journal volume managementtable of a primary storage system at the point in time when pair statusacquisition processing is executed at a certain time in a remote copysystem according to an embodiment of the present invention;

FIG. 34C is a diagram showing contents of a journal volume managementtable of a secondary storage system at the point in time when pairstatus acquisition processing is executed at a certain time in theremote copy system according to an embodiment of the present invention;

FIG. 34D is a diagram showing contents of a pair status table at thepoint in time when pair status acquisition processing is executed at acertain time in a remote copy system according to an embodiment of thepresent invention;

FIG. 35A is a diagram showing contents of a copy management table at thepoint in time when pair status acquisition processing is executed at acertain time in a remote copy system according to an embodiment of thepresent invention;

FIG. 35B is a diagram showing contents of a journal volume managementtable of a primary storage system at the point in time when pair statusacquisition processing is executed at a certain time in a remote copysystem according to an embodiment of the present invention;

FIG. 35C is a diagram showing contents of a journal volume managementtable of a secondary storage system at the point in time when pairstatus acquisition processing is executed at a certain time in a remotecopy system according to an embodiment of the present invention;

FIG. 35D is a diagram showing contents of a pair status table at thepoint in time when pair status acquisition processing is executed at acertain time in a remote copy system according to an embodiment of thepresent invention;

FIG. 36A is a diagram showing contents of a copy management table at thepoint in time when the pair status acquisition processing is executed ata certain time after copy suspension processing is performed in theremote copy system according to an embodiment of the present invention;

FIG. 36B is a diagram showing contents of a journal volume managementtable of the primary storage system at the point in time when pairstatus acquisition processing is executed at a certain time after copysuspension processing is performed in a remote copy system according toan embodiment of the present invention;

FIG. 36C is a diagram showing contents of a journal volume managementtable of a secondary storage system at the point in time when pairstatus acquisition processing is executed at a certain time after copysuspension processing is performed in a remote copy system according toan embodiment of the present invention;

FIG. 36D is a diagram showing contents of a pair status table at thepoint in time when pair status acquisition processing is executed at acertain time after copy suspension processing is performed in a remotecopy system according to an embodiment of the present invention;

FIG. 37A is a diagram respectively showing contents of a copy managementtable at the point in time when pair status acquisition processing isexecuted at a certain time after copy suspension processing is performedin a remote copy system according to an embodiment of the presentinvention;

FIG. 37B is a diagram showing contents of a journal volume managementtable of a primary storage system at the point in time when pair statusacquisition processing is executed at a certain time after copysuspension processing is performed in a remote copy system according toan embodiment of the present invention;

FIG. 37C is a diagram showing contents of a journal volume managementtable of a secondary storage system at the point in time when pairstatus acquisition processing is executed at a certain time after copysuspension processing is performed in a remote copy system according toan embodiment of the present invention;

FIG. 37D is a diagram showing contents of a pair status table at thepoint in time when pair status acquisition processing is executed at acertain time after copy suspension processing is performed in a remotecopy system according to an embodiment of the present invention;

FIG. 38A is a diagram showing contents of a copy management table when afailure occurs in a primary volume at a certain time in a remote copysystem according to an embodiment of the present invention;

FIG. 38B is a diagram showing contents of a journal volume managementtable of a primary storage system when a failure occurs in tahe primaryvolume at a certain time in a remote copy system according to anembodiment of the present invention;

FIG. 38C is a diagram showing contents of a journal volume managementtable of a secondary storage system when a failure occurs in a primaryvolume at a certain time in a remote copy system according to anembodiment of the present invention;

FIG. 38D is a diagram showing contents of a pair status table when afailure occurs in a primary volume at a certain time in the remote copysystem according to an embodiment of the present invention;

FIG. 39A is a diagram showing contents of a copy management table when afailure occurs in a secondary volume at a certain time in a remote copysystem according to an embodiment of the present invention;

FIG. 39B is a diagram showing contents of a journal volume managementtable of a primary storage system when a failure occurs in a secondaryvolume at a certain time in a remote copy system according to anembodiment of the present invention;

FIG. 39C is a diagram showing contents of a journal volume managementtable of a secondary storage system when a failure occurs in a secondaryvolume at a certain time in a remote copy system according to anembodiment of the present invention;

FIG. 39D is a diagram showing contents of a pair status table when afailure occurs in a secondary volume at a certain time in a remote copysystem according to an embodiment of the present invention;

FIG. 40A is a diagram respectively showing contents of a copy managementtable at the point in time when pair status acquisition processing isexecuted at a certain time after pair deletion processing is performedin a remote copy system according to an embodiment of the presentinvention;

FIG. 40B is a diagram showing contents of a journal volume managementtable of the primary storage system at the point in time when pairstatus acquisition processing is executed at a certain time after pairdeletion processing is performed in a remote copy system according to anembodiment of the present invention;

FIG. 40C is a diagram showing contents of a journal volume managementtable of a secondary storage system at the point in time when pairstatus acquisition processing is executed at a certain time after pairdeletion processing is performed in a remote copy system according to anembodiment of the present invention; and

FIG. 40D is a diagram showing contents of a pair status table at thepoint in time when pair status acquisition processing is executed at acertain time after pair deletion processing is performed in a remotecopy system according to an embodiment of the present invention.

DETAILED DESCRIPTION

The preferred embodiments for working the present invention are nowexplained in detail with reference to the attached drawings. The presentinvention, however, is not limited to the following examples, and allowsvarious modifications and applications within the gist hereof.

First Embodiment

The first embodiment explains a remote copy system that selects, basedon the operating status of a secondary storage system, either latesttime among the times each attached to journals that the secondarystorage system received or timestamp attached to a journal that was laststored in the secondary volume, and provide the selected time as arecovery point objective to a user of a computer system.

By way of this, since the user of the computer system can easilyrecognize a valid recovery point objective, even if a failure occurs ina primary site or in a communication line between a primary storagesystem and a secondary storage system, the user can accurately designatethe recovery point objective without hesitating to make a decision.Consequently, data can be recovered with certainty.

FIG. 1 is a diagram showing an overall configuration of a remote copysystem according to the first embodiment of the present invention. Asshown in FIG. 1, the remote copy system of this embodiment is configuredto include a computer system 100 at a primary site, and a computersystem 100 at a secondary site located at a physically remote locationfrom the primary site. Hereinafter, the computer system 100 located atthe primary site is referred to as the “computer system 100 a” whereasthe computer system 100 located at the secondary site is referred to asthe “computer system 100 b.” Other components or elements will bedenoted in a like manner if it is necessary to particularly distinguishbetween them.

The computer system 100 a comprises a primary host computer 110 a and aprimary storage system 120 a. The secondary computer system 100 bcomprises a secondary host computer 110 b and a secondary storage system120 b. Although FIG. 1 shows one primary host computer 110 a and onesecondary host computer 110 b, the configuration of the presentinvention is not limited thereto. Likewise, a plurality of primarystorage systems 120 a and a plurality of secondary storage systems 120 bmay also be provided. In addition, the terms “primary” and “secondary”are used in the relative relationship between the components, and thecomputer system 100 a as shown could serves as a secondary computersystem in the relationship with another computer system that is notshown.

The primary host computer 110 a and the primary storage system 120 a areoperatively interconnected with each other via a communication line 130a, and the secondary host computer 110 b and the secondary storagesystem 120 b are operatively interconnected with each other via acommunication line 130 b. Further, the primary storage system 120 a andthe secondary storage system 120 b are operatively interconnected witheach other via a communication line 140.

The primary storage system 120 a includes a primary command device 121a, one or more primary volumes 122 a, and one or more primary journalvolumes 123 a. The secondary storage system 120 b also includes asecondary command device 121 b, one or more secondary volumes 122 b, andone or more secondary journal volumes 123 b.

The primary command device 121 a and the secondary command device 121 bare respectively configured to receive various commands issued from theprimary host computer 110 a and the secondary host computer 110 b. Theprimary command device 121 a and the secondary command device 121 b areused as special volumes for communicating with storage systems otherthan its own storage system.

The primary volume 122 a stores data to be used by an applicationprogram in the primary host computer 110 a. The secondary volume 122 bis a replica or copy of the primary volume created with the remote copyfunction of the storage system.

The primary journal volume 123 a is a volume for storing journals asupdate logs of the primary volume 122 a. The primary storage system 120a writes journals into the primary journal volume 123 a upon updatingthe primary volume 122 a. The secondary journal volume 123 b is a volumefor storing journals acquired from the primary journal volume 123 a viathe communication line 140.

In execution of remote copy, one primary volume 122 a and one secondaryvolume 122 b forms a copy pair, and an aggregation of a plurality ofcopy pairs forms a copy group 124.

The configuration of the computer system 100 is now explained.

FIG. 2 is a diagram explaining the configuration of the primary hostcomputer 110 a of the remote copy system according to the firstembodiment of the present invention.

Referring to FIG. 2, the primary host computer 110 a comprises aprocessor 200, a memory 201, and an I/O processor 202, and thesecomponents are connected with a communication path (not shown). Theconfiguration of the secondary host computer 110 b is the same as theprimary host computer 110 a.

FIG. 3 is a diagram explaining the contents of the memory 201 in theprimary host computer 110 a of the remote copy system according to thefirst embodiment of the present invention.

As shown in FIG. 3, the memory 201 stores an OS 300, a business program301, a storage operation program 302, a storage management program 303,a volume definition table 304, a copy group definition table 305, acommand device definition table 306, a path definition table 307, and acopy group management table 308.

The business program 301 is an application program running on the OS 300that reads and writes data from and into the primary volume 122 a.

The storage operation program 302 is an application program running onthe OS 300. The storage operation program 302 uses the volume copyprocessing provided by the storage management program 303, and creates areplication of a volume from the primary volume to the secondary volumeaccording to the operational rules of the computer system.

The storage management program 303 is also an application program of theOS 300. The storage management program 303 provides processing forperforming volume copy control of the storage system to the storageoperation program 302.

The volume definition table 304, the copy group definition table 305,the command device definition table 306, and the path definition table307 are dedicated control tables that are created by the storagemanagement program 303. These tables may also be stored in a volume thatis readable and writable from the OS 300.

The copy group management table 308 is an area that is set when pairstatus acquisition processing provided by the storage management program303 is invoked, and stores the status of the storage system. The storageoperation program 302 refers to the area and acquires the status of thestorage system.

These programs and tables may also exist in a separate primary hostcomputer 110 a connected to the primary storage system 120 a. Thesecondary host computer 110 b may also retain similar contents in itsmemory 201 b.

FIG. 4 is a diagram showing an example of the volume definition table304 retained by the host computer in the remote copy system according tothe first embodiment of the present invention. The volume definitiontable 304 defines the volumes to be handled by the storage managementprogram 303, and also associates the apparatus address managed by the OS300 and the apparatus address managed by the storage system.

Specifically, as shown in FIG. 4, the volume definition table 304 hasone or more entries including a volume address 400 and a device ID 401.The volume address 400 is an address for the storage system to identifythe apparatus. The device ID 401 is an address to be identified by theOS 300 on which the storage management program 303 is running.

The storage system 120 and the OS 300 generally recognize apparatusesusing respectively different information. Thus, for the purpose ofexplanation, the apparatus recognized by the storage system 110 isreferred to as a “volume address,” and the apparatus address recognizedby the OS 300 is referred to as a “device ID.”

FIG. 5 is a diagram showing an example of the copy group definitiontable 305 expanded in the memory 201 of the host computer 110 of theremote copy system according to the first embodiment of the presentinvention. The copy group definition table 305 is a table for definingthe copy group 124.

Specifically, as shown in FIG. 5, the copy group definition table 305includes a copy group ID 500, a primary copy ID 501, a secondary copy ID502, a primary volume address 503, and a secondary volume address 504.

The copy group ID 500 is an identifier for uniquely identifying the copygroup 124, and is used by the storage operation program 302 to selectthe copy group 124.

The primary copy ID 501 is a resource of the primary storage system 120a and an identifier associated with one or more journal volumes 123 abelonging to the primary storage system 120 a, and the secondary copy ID502 is a resource of the secondary storage system 120 b and anidentifier associated with one or more journal volumes 123 b belongingto the secondary storage system 120 b. When viewed from the applicationprogram of the host computer 110, the primary copy ID 501 and thesecondary copy ID 502 are respectively units for guaranteeing thewriting order into the volume.

The primary volume address 503 is a volume address of the primary volume122 a included in the copy group 124. The secondary volume address 504is a volume address of the secondary volume 122 b.

At least one primary copy ID 501 and one secondary copy ID 5021 shouldexist for one copy group ID 500. There is only one secondary volumeaddress 504 that can be a copy pair with one primary volume address 503.The copy group 124 may include one or more copy pairs. In other words,pairs of one or more primary volume addresses 503 and secondary volumeaddresses 504 may exist for one copy group ID 500.

There may be a plurality of copy group IDs 500 in the copy groupdefinition table 305.

FIG. 6 is a diagram showing an example of the command device definitiontable 306 retained by the host computer 110 of the remote copy systemaccording to the first embodiment of the present invention. The commanddevice definition table 306 is a table for defining the command device.

Specifically, as shown in FIG. 6, the command device definition table306 includes a command device volume address 600 and a device ID 601.The command device volume address 600 is a volume address of the commanddevice belonging to the storage system. The device ID 601 is a device IDof the command device.

FIG. 7 is a diagram showing an example of the path definition table 307retained by the host computer 110 in the remote copy system according tothe first embodiment of the present invention. The path definition table307 is a table for defining the communication path between commanddevices. By defining the communication path, the storage managementprogram 303 is able to perform volume copy control and statusacquisition to the volumes of a storage system that cannot be managedwith the OS located at a remote site.

Specifically, as shown in FIG. 7, the path definition table 307 includesan origin volume address 701 and a terminal volume address 702. Theorigin volume address 701 designates the volume address of the commanddevice to issue the command. The terminal volume address 702 designatesthe volume address of the command device to receive the command.

FIG. 8 is a diagram showing an example of the copy group managementtable 308 retained by the host computer 110 in the remote copy systemaccording to the first embodiment of the present invention.

As shown in FIG. 8, the copy group management table 308 includes a copygroup ID 800, a primary copy ID 801, a secondary copy ID 802, a primaryvolume address 803, a secondary volume address 804, a pair status 805,and a consistency time 806.

The copy group management table 308 is an area for storing theprocessing result of the pair status acquisition module 2704 shown inFIG. 27 explained later. Thus, the copy group ID 800, the primary copyID 801, the secondary copy ID 802, the primary volume address 803, andthe secondary volume address 804 are configured the same as the copygroup definition table 305.

The pair status 805 is a status of the copy pair belonging to the copygroup. The consistency time 806 represents the recovery point objectiveof the copy group.

The configuration of the storage system 120 is now explained.

FIG. 9 is a diagram showing the configuration of the primary storagesystem 120 a in the remote copy system according to the first embodimentof the present invention.

Referring to FIG. 9, the primary storage system 120 a comprises an I/Ocontroller 900, a cache unit 910, a shared memory unit 920, a diskcontroller 930, and a disk device unit 940.

The I/O controller 900 comprises a processor 901, a memory 902, and anI/O receiver 903. The I/O receiver 903 is connected to the primary hostcomputer 110 a and the secondary storage system 120 b via thecommunication lines 130 and 140, respectively.

The shared memory unit 920 stores an I/O processing program 921 forwriting data into a volume, a copy processing program 922 for performsthe remote copy, a copy management table 923 and a journal volumemanagement table 924 as the control tables of the copy processingprogram 922, and a failure recovery program 925 to handle the processingif a failure occurs in the storage system.

The copy management table 923 and the journal volume management table924 are tables for retaining the status of the copy group and the statusof the journal volume, respectively. Details concerning these tableswill be explained later.

The secondary storage system 120 b also comprises an I/O controller 900,a cache unit 910, a shared memory unit 920, a disk controller 930, and adisk device unit 940 as with the primary storage system 120 a.

FIG. 10 is a diagram showing the configuration of the copy processingprogram 922 of the storage system 100 according to the first embodimentof the present invention. As shown in FIG. 10, the copy processingprogram 922 comprises a journal creation module 1000, a journal readmodule 1001, and a journal restoration module 1002. The processingcontents of the respective modules of the copy processing program 922will be described later.

The control tables in the storage system are now explained.

FIG. 11A is a diagram showing the primary journal volume 123 a retainedby the storage system 110 a in the remote copy system according to thefirst embodiment of the present invention.

As shown in FIG. 11, the primary journal volume 123 a includes a journalmanagement table 1100 for managing the update history of the primaryvolume 122 a.

The journal management table 1100 includes, as shown in FIG. 11B, ajournal volume address 1101, a data address 1102, an update data 1103,and a write command issue time 1104.

The journal volume address 1101 and the data address 1102 are addressesto which data was written according to the write command, respectively.The update data 1103 is data that was written according to the writecommand of the primary volume 122 a. The write command issue time 1104is the time that is added to a write command when the OS 300 issues suchwrite command.

The secondary journal volume 123 b of the secondary storage system 110 balso has the same configuration.

FIG. 12 is a diagram showing the copy management table 923 retained bythe storage system 10 in the remote copy system according to the firstembodiment of the present invention. The copy management table 923 is atable that is retained by the primary storage system 120 a and thesecondary storage system 120 b, respectively, and used for managing thestatus of the copy pairs included in the copy group.

The copy management table 923 includes a primary copy ID 1200, asecondary copy ID 1201, a primary volume address 1202, a secondaryvolume address 1203, a pair status 1204, a restoration finish time 1205,and a validity flag 1206.

The primary copy ID 1200 and the secondary copy ID 1201 are identifiersfor identifying each copy group, which is a resource of either theprimary storage system 120 a or the secondary storage system 120 b.

The primary volume address 1202 and the secondary volume address 1203are addresses of the primary volume 122 a and the secondary volume 122 bconfiguring a copy pair.

The pair status 1204 shows the copy pair status. The copy pair statusindicates any one of, among others, a Simplex status, a Copying status,a Duplex status, a Suspending status, a Suspend-Operation status, aDeleting status, and a Suspend-Failure status. The pair status 1204shows the result of recording and updating the pair status of the copygroup 124 created from the primary storage volume 122 a and thesecondary storage volume 122 b in the pair creation processing (FIG. 16)and the pair status acquisition processing (FIG. 20A) described later.In other words, the “Copying status” is recorded in the pair creationprocessing, and the pair status during the pair status acquisitionprocessing is updated to the pair status such as “Copying” or“Suspend-Failure” in the pair status acquisition processing. Therelationship among the respective copy pair statuses will be describedlater with reference to FIG. 28.

The restoration finish time 1205 is set as the time attached to ajournal when such journal stored in the secondary journal volume 123 bis reflected in the secondary volume 122 b with the journal restorationmodule 1002 of the copy processing program 922.

The validity flag 1206 is a flag showing whether the restoration finishtime 1205 is valid or invalid.

FIG. 13 is a diagram showing the journal volume management table 924retained by the storage system 120 in the remote copy system accordingto the first embodiment of the present invention.

As shown in FIG. 13, the journal volume management table 924 includes acopy ID 1300, a volume address 1301, a volume status 1302, a journalreception time 1303, and a validity flag 1304.

The volume status 1302 shows the status regarding whether that volume iscurrently subject to a failure. The journal reception time 1303 is anarea for setting the latest time among the time attached to the receivedjournal. In the journal volume management table 924 b of the secondarystorage system 120 b, the time attached to the latest journal receivedfrom the primary storage system 120 a will be the journal reception time1303. The validity flag 1304 is a flag indicating whether the journalreception time 1303 is valid.

The storage management program 303 of the host computer 110 is explainedas follows.

FIG. 27 is a diagram showing the storage management program 303 of thehost computer 110 according to the first embodiment of the presentinvention.

As shown in FIG. 27, the storage management program 303 comprises a paircreation module 2700, a copy suspension module 2701, a copy resumptionmodule 2702, a copy deletion module 2703, and a pair status acquisitionmodule 2704. The storage management program 303 issues commands createdby these modules to the storage system 120.

The pair creation module 2700 performs processing for changing the copypair in a Simplex status, in which remote copy has not been started,into a Duplex status. In the case of a Simplex status, the update of theprimary volume 122 a is not reflected in the secondary volume 122 b.When the copy pair becomes a Duplex status, the update is reflected inthe secondary volume 122 b.

The copy suspension module 2701 performs processing for temporarilysuspending the remote copy of the copy pair in a Duplex status. The copysuspension module 2701 can be used upon determining the point in time towhich the secondary volume 122 b belongs. Namely, the copy suspensionmodule 2701 can be used upon determining the data of which point in timeis to be reflected in the secondary volume, or when a system failure ora communication failure occurs.

The copy resumption module 2702 performs processing of resuming theremote copy of the copy pair in which the remote copy was of atemporarily suspended status due to copy suspension processing oroccurrence of a failure.

The copy deletion module 2703 performs processing of deleting the remotecopy and changing the copy pair to a Simplex status.

The pair status acquisition module 2704 performs processing foracquiring the copy pair status. The pair statuses to be acquired by thepair status acquisition module 2704 will be described later.

FIG. 28 is a diagram explaining the copy pair statuses in the remotecopy system according to the first embodiment of the present invention.

The copy pair status (sometimes also referred to as a “pair status”)includes a Simplex status 2800, a Copying status 2801, a Duplex status2802, a Suspending status 2803, a Suspend-Operation status 2804, aDeleting status 2805, and a Suspend-Failure status 2806.

The Simplex status 2800 is an initial status before configuring the copypair. In addition, if pair deletion processing is executed to a copypair to which remote copy has already been configured, this will also bea Simplex status.

The Duplex status 2802 is a status where the primary volume 122 a andthe secondary volume 122 b are duplexed. If the copy pair is a Duplexstatus, writing of data into the primary volume 122 a will be reflectedin the secondary volume 122 b.

The Copying status 2801 is a transitional status showing that thecreation/copy based on the processing of the pair creation module 2700is being executed, or that the differential copy based on the processingof the copy resumption module 2702 is being executed. When thecreation/copy or the differential copy is complete, the copy pair statuschanges to a Duplex status.

The Suspend-Operation status 2804 is a status where the storagemanagement program 303 temporarily suspended the remote copy based onthe processing of the copy suspension module 2701.

The Suspending status 2803 is a transitional status until changing tothe Suspend-Operation status when the copy suspension module 2701performs processing to the copy pair of a Duplex status.

The Deleting status 2805 is a transitional status until changing to theSimplex status based on the processing of the copy deletion module 2703.A copy pair changes to this status other than from the Simplex status2800 and the Deleting status 2805.

The Suspend-Failure status 2806 is a status where the duplexing (remotecopy) of the primary volume 122 a and the secondary volume 122 b istemporarily suspended due to a hardware failure. A copy pair changes tothis status other than from the Simplex status and the Suspend-Failurestatus.

FIG. 29 is a diagram explaining the operation concerning a copy group inthe remote copy system according to the first embodiment of the presentinvention. FIG. 29 shows the command path upon the storage operationprogram 302 running on the primary host computer 110 a using theprocessing provided by the respective modules of the storage managementprogram 303 and operating the copy group. As the command path, there isa path (2900) for sending a command to the primary volume 122 a and apath (2901) for sending a command to the primary command device 121 a.

Referring to FIG. 29, foremost, the storage operation program 302 callsa module corresponding to the storage management program 303, and thestorage management program 303 creates a command to the primary storagesystem and uses the I/O function provided by the OS 300 to issue aprescribed I/O command to the primary volume (2900). In addition, thestorage management program 303 may issue a prescribed I/O command to theprimary command device 121 a (2901). Prescribed I/O commands will beexplained with reference to FIG. 14A to FIG. 14F.

The storage management program 303 receives the result to the prescribedI/O command from the OS 300, and reports the result to the storageoperation program 302.

If an I/O command is issued to the command device 121 a, the I/O commandcan be transferred to storage systems other than the storage systemconnected to itself. In this case, the I/O command is transferred fromthe primary command device 121 a to the secondary command device 121 b(2902). By transferring the I/O command to storage systems other thanthe storage system connected to itself via the communication line 140,the storage management program 303 executes remote copy processing to acopy group of the storage system that is not directly connected toitself.

The storage management program running on the secondary host computer110 b can also execute the same processing as the storage managementprogram running on the primary host computer 110 a by issuing an I/Ocommand to the secondary volume 122 b or the secondary command device121 b.

The flow of this kind of data processing is executed with the copyprocessing program 922 stored in the shared memory unit 920.

FIG. 30 is a diagram explaining the remote copy processing in the remotecopy system according to the first embodiment of the present invention.Specifically, FIG. 30 explains the flow of data when data that iswritten into the primary volume 122 a with the business program 301running on the primary host computer 110 a is also written into thesecondary volume 122 b in a case where the copy pair status in theremote copy system is a Duplex status.

Referring to FIG. 30, when the business program 301 running on theprimary host computer 110 a requests the OS 300 to perform writeprocessing to data of the primary volume 122 a, the OS 300 issues awrite command to the primary volume 122 a (3000). At this time, the OS300 adds the time (time stamp) that the command was issued to the writecommand. When the primary storage system 120 a receives the writecommand, the journal creation module 1000 writes the contents of thewrite command into the primary volume 122 a (3001), creates a journalbased on the time added to the write command, writes this journal intothe primary journal volume 123 a (3002), and sends an I/O commandcompletion report to the OS 300.

Meanwhile, on the side of the secondary storage subsystem 122 b, thejournal read module 1001 reads the journal from the primary journalvolume 123 a and writes it into the secondary journal volume 123 b(3003).

Finally, the journal restoration module 1002 reflects the journals,which are stored in the secondary journal volume 123 b, in the secondaryvolume 122 b sequentially according to the time added to the journal(3004).

By way of this, the write command that was written into the primaryvolume is reflected in the secondary volume in the same sequence as theupdate sequence of the primary volume.

The various I/O commands used in the remote copy system of thisembodiment are now explained. As the I/O commands, there may, forinstance, be a write command issued by the OS 300 that received a writerequest of data from the business program 301, and the various commandsconcerning remote copy that are created by the respective modules 2700to 2704 of the storage management program 303.

FIGS. 14A-14F are diagrams explaining the I/O commands used in theremote copy system according to the first embodiment of the presentinvention. Specifically, FIG. 14A shows an example of a format of awrite command 1400, FIG. 14B shows an example of a format of a paircreation command 1410, FIG. 14C shows an example of a format of a copysuspension command 1420, and FIG. 14D shows an example of a format of acopy resumption command 1430. Moreover, FIG. 14E shows an example of aformat of the copy deletion command 1500, and FIG. 14F shows an exampleof a format of a pair status acquisition command 1510.

The write command 1400 shown in FIG. 14A includes a command code 1401, acommand control table 1402, and a write command issue time 1403. Thecommand issue time is time information added by the OS 300.

The pair creation command 1410 shown in FIG. 14B includes a command code1411, a primary copy ID 1412, a secondary copy ID 1413, a copy sourcevolume address 1414, and a copy destination volume address 1415. Thecopy source volume address 1414 and the copy destination volume address1415 are the volume address of the primary volume 122 a and the volumeaddress of the secondary volume 122 b configuring a copy pair,respectively.

The copy suspension command 1420 shown in FIG. 14C includes a commandcode 1421, an execution mode 1422, a copy source volume address 1423, acopy destination volume address 1424, and a pair suspension commandissue time 1425. The execution mode 1422 designates the handling of ajournal that was written into the primary volume 122 a but not reflectedin the secondary volume 122 b. Specifically, the attribute of either“Flush” or “Purge” is at least designated. “Flush” is a designation forreflecting the journals before the time set as the pair suspensioncommand issue time 1425 in the secondary volume, and then changing thecopy pair to a Suspend-Operation status 2804 (FIG. 28). In contrast,“Purge” is a designation for discarding the journals at the point intime that the storage system receives a pair suspension command, andimmediately changing the copy pair to a Suspend-Operation status 2804(FIG. 28).

Since the journals are discarded when “Purge” is designated, the timeadded to the journal cannot be used as the recovery point objective(consistency time). In this case, the latest time of the journalreflected in the secondary volume will be the recovery point objective.

The copy source volume address 1423 and the copy destination volumeaddress 1424 are the volume address of the primary volume and the volumeaddress of the secondary volume configuring a copy pair, respectively.The pair suspension command issue time 1425 is the time that the pairsuspension command 1420 will be issued.

The copy resumption command 1430 shown in FIG. 14D includes a commandcode 1431, a copy source volume address 1432, and a copy destinationvolume address 1433.

The copy deletion command 1500 shown in FIG. 14E includes a command code1501, a copy source volume address 1502 and a copy destination volumeaddress 1503. The copy source volume address 1502 and the copydestination volume address 1503 are the volume address of the primaryvolume and the volume address of the secondary volume configuring a copypair, respectively.

The pair status acquisition command 1510 shown in FIG. 14F includes acommand code 1511 and an address volume address 1512. When the storagemanagement program 303 issue the pair status acquisition command 1510under the instructions of the storage operation program 302, the copyprocessing program 922 of the storage system 120 that received thecommand creates and returns a pair status table 1520.

FIG. 15 is a diagram explaining the pair status table 1520 in the remotecopy system according to the first embodiment of the present invention.The pair status table 1520 indicates a result in response to the pairstatus acquisition command.

As shown in FIG. 15, the pair status table 1520 includes a copy sourcevolume address 1521, a copy destination volume address 1522, a primarycopy ID 1523, a secondary copy ID 1524, a pair status 1525, and aconsistency time 1526. In this embodiment, the consistency time 1526 isthe recovery point objective.

The various processing operations of the remote copy system of thisembodiment are now explained with reference to the flowcharts shown inFIG. 16 to FIG. 22.

With the remote copy system of this embodiment, if a failure occursduring any one of the write I/O processing, pair creation processing,copy suspension processing, copy resumption processing, and copydeletion processing, or if a failure occurs in the journal volume, thecopy processing program 922 updates the copy management table 923 andthe journal volume management table 924. When the pair statusacquisition processing is executed, the copy processing program 922makes a reply be setting a recovery point objective (consistency time)in the pair status table 1520 according to the status of the copymanagement table 923 and the journal volume management table 924.

FIG. 16 is a flowchart explaining the pair creation processing in theremote copy system according to the first embodiment of the presentinvention.

Referring to FIG. 16, foremost, the storage operation program 302running on the primary host computer 110 a designates the copy group ID5007 and commands the storage management program 303 to create a pair(1600). Upon receiving this command, the storage management program 303commands the volumes in the copy group to create pairs (1601).

In response to this, the copy processing program 922 of the primarystorage system 120 a adds one pair worth of entries to the copymanagement table 923 (1602).

Subsequently, the copy processing program 922 executes the remote copyof data in the primary volume 122 a (1603). Remote copy is performed bytransferring journals. In conjunction with this, the copy processingprogram 922 updates the copy management table 923 and the journal volumemanagement table 924 (1604). Specifically, the copy processing program922 sets the pair status 1204 of the copy management table 923 to“Copying,” and sets the valid flag 1206 to “invalid.” The copyprocessing program 922 sets the valid flag 1304 of the journal volumemanagement table 924 to “invalid.” When the data copy is complete, thecopy processing program 922 sends an I/O command completion report tothe OS 300 of the primary host computer 110 a (1605).

FIG. 17 is a flowchart showing the copy suspension processing in theremote copy system according to the first embodiment of the presentinvention.

Referring to FIG. 17, the storage operation program 302 of the primaryhost computer 110 a designates the copy group ID 500 and the executionmode 1422, and commands the storage operation program 302 to suspendcopy (1700). Upon receiving this command, the storage management program303 commands the volumes in the copy group to suspend copy (1701).

In response, the copy processing program 922 subsequently suspends thedata copy (1702). In conjunction with this, the copy processing program922 updates the copy management table 923 (1703). Specifically, the copyprocessing program 922 sets the pair status 1204 of the copy managementtable 923 to “Suspending.” In addition, the copy processing program 922checks the execution mode 1422 (1704) and, if the mode is “Purge,” itsets the valid flag 1304 of the journal volume management table 924 to“invalid” (1705).

The copy processing program 922 thereafter sends an I/O commandcompletion report to the OS 300 of the primary host computer 110 a(1706).

FIG. 18 is a flowchart explaining the copy resumption processing in theremote copy system according to the first embodiment of the presentinvention.

Referring to FIG. 18, foremost, the storage operation program 302 of theprimary host computer 110 a designates the copy group ID 500, andcommands the storage management program 303 to resume copy (1800). Uponreceiving this command, the storage management program 303 commands thevolumes in the copy group to resume copy (1801).

In response, the copy processing program 922 subsequently resumes thedata copy (1802). In conjunction with this, the copy processing program922 updates the copy management table 923 (1803). Specifically, the copyprocessing program 922 sets the pair status 1203 of the copy managementtable 923 to “Copying.”

The copy processing program 922 thereafter sends an I/O commandcompletion report to the OS 300 of the primary host computer 110 a(1804).

FIG. 19 is a flowchart explaining the copy deletion processing in theremote copy system according to the first embodiment of the presentinvention.

Referring to FIG. 19, the storage operation program 302 of the primaryhost computer 110 a designates the copy group ID 500, and commands thestorage management program 303 to delete copy (1900). Upon receivingthis command, the storage management program 303 commands the volumes inthe copy group to delete copy (1901).

In response to this, the copy processing program 922 subsequentlydeletes the data copy (1902). In conjunction with this, the copyprocessing program 922 updates the copy management table 923 (1903).Specifically, the copy processing program 922 sets the pair status 1204of the copy management table 923 to “Deleting.” In addition, the copyprocessing program 922 deletes the entries of the copy source volumeaddress 1502 and the primary volume address 1202 in the copy managementtable 923 that coincide, and deletes the entries of the copy destinationvolume address 1503 and the secondary volume address 1203 in the copymanagement table 923 that coincide.

The copy processing program 922 thereafter sends an I/O commandcompletion report to the OS 300 of the primary host computer 110 a(1905).

FIG. 20A is a flowchart explaining the pair status acquisitionprocessing in the remote copy system according to the first embodimentof the present invention.

Referring to FIG. 20A, the storage operation program 302 of the primaryhost computer 110 a designates the copy group ID 500, and commands thestorage management program 303 acquires the pair status (2000). Uponreceiving this command, the storage management program 303 commands thevolumes in the designated copy group 124 to acquire the pair status(2001).

In response, the copy processing program 922 subsequently sets the pairstatus table 1520 (2002). Specifically, the copy processing program 922sets the primary volume address 1202 to the copy source volume address1521 of the pair status table 1520, sets the secondary volume address1203 to the copy destination volume address 1522, sets the primary copyID 1200 to the primary copy ID 1523, sets the secondary copy ID 1201 tothe secondary copy ID 1524, and sets the pair status 1204 to the pairstatus 1525. Subsequently, the copy processing program 922 executes theconsistency time setting processing X to set the consistency time 1526(2003).

The OS 300 sends an I/O command completion report to the storagemanagement program 303 (2004). In response, the storage managementprogram 303 calls the copy group management table 305 setting processing(2005). The storage management program 303 thereafter sends an I/Ocommand completion report and the contents of the pair status table 1520to the storage operation program 302 (2006).

FIG. 20B is a flowchart explaining the consistency time settingprocessing X in the remote copy system according to the first embodimentof the present invention. The consistency time setting processing X is apart of the processing of the pair status acquisition module 2704 in thecopy processing program 922.

In this embodiment, the consistency time setting processing X is usedfor selecting the recovery point objective (consistency time) accordingto the status of the storage system.

Referring to FIG. 20B, the copy processing program 922 checks the pairstatus 1204 (2000 b). When the copy processing program 922 determinesthat the pair status 1204 is one among Suspend-Operation status,Suspending status, Suspend-Failure status, or Duplex status, itadditionally checks the valid flag 1304 (2001 b).

If the copy processing program 922 determines that the validity flag1304 is valid, it returns the journal reception time 1303 (2003 b).Meanwhile, if the copy processing program 922 determines that the validflag 1304 is invalid, it additionally checks the valid flag 1206 (2002b). If the copy processing program 922 determines that the valid flag1206 is valid, it returns the restoration finish I/O command time 1205(2004 b). Meanwhile, if the copy processing program 922 determines thatthe valid flag 1206 is invalid, the copy processing program 922 returns“invalid” (2005 b).

Contrarily, if the pair status is Simplex status, Copying status, orDeleting status as a result of checking the pair status 1204 (2000 b),[the copy processing program 922] returns “invalid” (2005 b).

FIG. 20C is a flowchart explaining the copy group management table 305setting processing in the remote copy system according to the firstembodiment of the present invention.

Referring to FIG. 20C, foremost, the storage management program 303configures the setting of a prescribed field in the copy groupmanagement table 308 (2000 c). Specifically, the storage managementprogram 303 sets the copy source volume address 1521 of the pair statustable 1520 to the primary volume address 803 of the copy groupmanagement table 308. Similarly, the storage management program 303 setsthe copy destination volume address 1522 to the secondary volume address804, sets the primary copy ID 1523 to the primary copy ID 801, sets thesecondary copy ID 1524 to the secondary copy ID 802, and sets the pairstatus 1525 to the pair status 804.

The storage management program 303 subsequently sets the consistencytime 1526 of the pair status table 1520 to the consistency time 806 ofthe copy group management table 308 (2001 c).

FIG. 21A is a flowchart explaining the failure-detected processing inthe remote copy system according to the first embodiment of the presentinvention, and specifically explains the processing to be performed whena hardware failure is detected in the secondary journal volume 122 b.

Referring to FIG. 21A, the failure recovery program 925 of the secondarystorage system 120 b detects a failure of the disk device 940 (2100 a).Subsequently, the failure recovery program 925 notifies the volumeaddress of the failed disk device 940 to the copy processing program 922(2101 a).

In response to this, the copy processing program 922 updates the journalvolume management table 924 (2102 a). Specifically, the copy processingprogram 922 sets the volume status 1302 of the journal volume managementtable 924 to “failure,” and the validity flag 1304 to “invalid.” Inaddition, the copy processing program 922 sets the pair status 1204 ofthe copy management table 923 to “Suspend-Failure.”

FIG. 21B is a flowchart explaining the failure-recovered processing inthe remote copy system according to the first embodiment of the presentinvention, and specifically explains the processing to be performed whenthe recovery from the hardware failure is detected in the secondaryjournal volume 122 b.

Referring to FIG. 21B, the failure recovery program 925 of the secondarystorage subsystem 120 b detects the failure recovery of the disk device940 (2100 b). Subsequently, the failure recovery program 925 notifiesthe volume address of the disk device 940 that recovered from a failureto the copy processing program 922 (2101 b).

In response, the copy processing program 922 sets the volume status 1302of the journal volume management table 924 to “normal” (2102 b).

FIG. 22 is a flowchart explaining the write processing in the remotecopy system according to the first embodiment of the present invention.Specifically, FIG. 22 shows the processing to be performed when theprimary host computer 110 a issues a write command to the primarystorage system 120 a in order to write data in the primary volume 121 a.

Referring to FIG. 22, the business program 301 of the primary hostcomputer 110 a sends a data write request to the primary volume 122 aunder the control of the OS 300 (2200). Upon receiving this request, thecopy processing program 922 a of the primary storage system 120 acommands the I/O program 921 to write data (2201). Subsequently, thecopy processing program 922 a of the primary storage system 120 acreates a journal and commands the primary journal volume 122 a to writethe data (2202).

The copy processing program 922 b of the secondary storage system 120 breceives the journal from the primary storage system 120 a (2203). Thecopy processing program 922 b of the secondary storage system 102updates the journal volume management table 924 using the receivedjournal (2204). Specifically, the copy processing program 922 b of thesecondary storage system 102 sets the write command issue time 1104 tothe journal reception time 1303 of the journal volume management table924, and sets the valid flag 1304 to “valid.” Subsequently, the copyprocessing program 922 b sequentially retrieves unprocessed journalsfrom the secondary journal volume 123 b and writes them into thesecondary volume (2206). The copy processing program 922 b updates thecopy management table 923 based on the retrieved journals (2206).Specifically, the copy processing program 922 b sets the valid flag 1206of the copy management table 923 to “valid,” and the restoration finishcommand time 1205 to the write command issue time 1104.

EXAMPLES

Calculation examples at the point in time the failure is recovered inthe remote copy system of this embodiment are now explained.

FIG. 31A is a diagram showing an example of the copy group definitiontable 305 of the host computer 100 in the remote copy system accordingto the first embodiment of the present invention. Further, FIG. 31Bshows an example of the journal volume management table 924 a of theprimary storage system 120 a and FIG. 31C shows an example of thejournal volume management table 924 b of the secondary storage system120 b in the remote copy system according to the first embodiment of thepresent invention.

In this example, a copy group 124 configured from three copy pairs isdefined. Specifically, as shown in FIG. 31A, in the copy groupdefinition table 305 of this example, “GRP01” is set as the copy groupID 500, “01” is set as the primary copy ID 501, and “02” is set as thesecondary copy ID 502. In addition, a pair of “P00” and “S00,” a pair of“P01” and “S01,” and a pair of “P02” and “S02” are respectively set inthe primary volume address 503 and the secondary volume address 504.

Moreover, as shown in FIG. 31B, “01” is set as the copy ID 1300 in thejournal volume management table 924 a of the primary storage system 120a. The copy ID 1300 is configured from two journal volumes “X00” and“X01.”

Furthermore, as shown in FIG. 31C, “02” is set as the copy ID 1300 inthe journal volume management table 924 b of the secondary storagesystem 120 b. Similarly, the copy ID 1300 is configured from two journalvolumes “Y00” and “Y01.”

FIG. 32 is a diagram showing, in a time series, operations to beperformed to the copy group 124 set in the remote copy system accordingto the first embodiment of the present invention.

Specifically, as shown in FIG. 32, the storage management program 303 ofthe primary host computer 110 a executes the following processing.

Executes the pair status acquisition processing at 10:00.

Executes the pair creation processing at 10:05. Executes the pair statusacquisition processing at 10:30.

Intermittently issues write commands to the primary volume at 10:35.

Executes the pair status processing at 12:30.

Copy is suspended due to any one of the following events at 12:40.

*The copy suspension processing is executed with the execution mode asFlush.

*The copy suspension processing is executed with the execution mode asPurge.

*A failure occurs in the primary volume.

*A failure occurs in the secondary journal volume.

Executes the pair status acquisition processing at 12:50.

Executes the pair status acquisition processing at 13:00.

Executes the pair status acquisition processing at 13:30.

Outline of the processing for acquiring the recovery point objective(consistency time) is now explained.

The control flag for selecting the recovery point objective is set whentriggered by the performance of pair creation processing, copysuspension processing, copy deletion processing, write processing, or afailure in the secondary journal volume.

Specifically, as described above, the control flags for selecting therecovery point objective are the valid flag 1206 of the copy managementtable 923 and the valid flag 1304 of the journal volume management table924. The validity flags 1206 and 1304 are set according to theflowcharts shown in FIG. 16 to FIG. 19, FIG. 21, and FIG. 22.

More specifically, the trigger for setting the validity flag 1304 of thejournal volume management table 924 to “valid” is when data is writteninto the primary volume 122 a, the secondary storage system 120 breceives a journal from the primary storage system 120 a, and suchjournal is stored in the secondary journal volume 123 b.

The trigger for setting the valid flag 1204 of the copy management table923 to “valid” is when the journal stored in the secondary journalvolume 123 b is reflected in the secondary volume 122 b.

The trigger for setting the validity flag 1306 of the journal volumemanagement table 924 and the validity flag 1204 of the copy managementtable 923 to “invalid” is as follows.

First, if the pair creation processing is executed, entries of the copymanagement table 923 regarding that copy pair are created, and “invalid”is set to the valid flag 1204 and “invalid” is set to the valid flag1306, respectively.

Second, if the copy suspension processing is executed by designating“Purge” as the execution mode, “invalid” is set to the valid flag 1306.

And third, if a failure occurs in the secondary journal volume 122 b,“invalid” is set to the valid flag 1306.

Additionally, even if the failed secondary journal volume 122 b recoversfrom its failure, “invalid” is not set to the valid flag 1306.

If the pair deletion processing is executed, since the pair status willbe a Simplex status, entries of the copy management table 923 of thatcopy pair are deleted.

If the copy processing is resumed and executed, these control flags arenot changed.

The copy processing program 922 of this embodiment sets the controlflags and sets the recovery point objective (consistency time) triggeredby the execution of the pair status acquisition processingasynchronously with the setting of the foregoing control flags.

The method of seeking the recovery point objective when the pair statusacquisition processing is executed at 10:00, 10:30, 12:30, 12:50, and13:30 as shown in FIG. 32 is now explained.

FIGS. 33A-33D are diagrams respectively showing the contents of therespective tables when the pair status acquisition processing isexecuted at a certain time in the remote copy system according to thefirst embodiment of the present invention. Specifically, FIG. 33A is adiagram showing the contents of the copy management table 923 at thetime the pair status acquisition processing is executed at 10:00 in theremote copy system according to the first embodiment of the presentinvention. FIG. 33B is a diagram showing the contents of the journalvolume management table 924 a of the primary storage system 120 a andFIG. 33C is a diagram showing the contents of the journal volumemanagement table 924 b of the secondary storage system 120 b at the timethe pair status acquisition processing is executed at 10:00 in theremote copy system according to the first embodiment of the presentinvention. FIG. 33D is a diagram showing the contents of the pair statustable 1520 at the time the pair status acquisition processing isexecuted at 10:00 in the remote copy system according to the firstembodiment of the present invention.

Specifically, as of 10:00, the journal volume management table 924 ashown in FIG. 33B and the journal volume management table 924 b shown inFIG. 33C are the same as the tables shown in FIG. 31B and FIG. 31C. Inaddition, as of 10:00, since it is the Simplex status as shown in FIG.33D, the consistency time 1525 is NULL and, therefore, the recoverypoint objective does not exist.

FIGS. 34A-34D are diagrams respectively showing the contents of therespective tables when the pair status acquisition processing isexecuted at a certain time in the remote copy system according to thefirst embodiment of the present invention. Specifically, FIGS. 34A 34Dare diagrams respectively showing the contents of the copy managementtable 923, the journal volume management table 924 a, the journal volumemanagement table 924 b, and the pair status table 1520 at the time thepair status acquisition processing is executed at 10:00 in the remotecopy system according to the first embodiment of the present invention.

As of 10:30, since the creation/copy processing has already beenexecuted, the pair status 1204 has changed to the Duplex status pursuantto the completion of the creation/copy. If the creation/copy isincomplete, the pair status will be a Copying status.

The recovery point objective at this point in time is sought as follows.

Specifically, the copy processing program 922 calls the consistency timesetting processing X, and determines whether the validity flag 1304 b ofthe journal volume management table 924 b shown in FIG. 34C is “valid.”In this example, since the validity flag 1304 b is “invalid,” the copyprocessing program 922 determines whether the validity flag 1206 of thecopy management table 923 shown in FIG. 34A is “valid.”

In this example, since the validity flag 1206 is “invalid,” the copyprocessing program 922 does not set a recovery point objective to theconsistency time 1526 of the pair status table 1520 shown in FIG. 34D.Thus, the consistency time 1526 is NULL.

FIGS. 35A-35D are diagrams respectively showing the contents of therespective tables when the pair status acquisition processing isexecuted at a certain time in the remote copy system according to thefirst embodiment of the present invention. Specifically, FIGS. 35A-35Dare diagrams respectively showing the contents of the copy managementtable 923, the journal volume management table 924 a, the journal volumemanagement table 924 b, and the pair status table 1520 at the time thepair status acquisition processing is executed at 12:30 in the remotecopy system according to the first embodiment of the present invention.

As of 12:30, data is being written into the primary volume 122 a withthe pair status being a Duplex status. Thus, a journal is created in theprimary storage system 120 a based on the writing of data into theprimary volume 122 a, the created journal is transferred to thesecondary storage system 120 b, and the journal that arrived at thesecondary storage system 120 b is reflected in the secondary volume 122b. The latest time among the time attached to the journals received bythe secondary storage system 120 b for each journal volume 123 b is setin the journal reception time 1303 b of the journal volume managementtable 924 b in the secondary storage system 120 b shown in FIG. 35B.

The recovery point objective at this point in time is sought as follows.

Specifically, the copy processing program 922 determines whether thevalidity flag 1304 b of the journal volume management table 924 b shownin FIG. 35C is “valid.” In this example, since the validity flag 1304 bis “valid,” the copy processing program 922 sets the journal receptiontime 1303 b (i.e., “12:24”) of the journal volume management table 924 bshown in FIG. 35B as the recovery point objective in the consistencytime 1526 of the pair status table 1520.

As described above and shown in FIG. 32, as factors for the copy of theprimary site to the secondary site being suspended at 12:40, describedwere the four methods of when the copy suspension processing isperformed in the execution mode of “Flush,” when the copy suspensionprocessing is performed in the execution mode of “Purge,” when a failureoccurs in the primary volume 122 a, and when a failure occurs in thesecondary journal volume 123 b. The processing in each of the foregoingcases is now explained with reference to FIG. 36 to FIG. 39.

FIGS. 36A-36D are diagrams respectively showing the contents of therespective tables when the pair status acquisition processing isexecuted at a certain time in the remote copy system according to thefirst embodiment of the present invention. Specifically, FIGS. 36A-36Dare diagram respectively showing the contents of the copy managementtable 923, the journal volume management table 924 a, the journal volumemanagement table 924 b, and the pair status table 1520 when the copysuspension processing in the execution mode of “Flush” is executed at12:40 and the pair status acquisition processing is executed at 12:50 inthe remote copy system according to the first embodiment of the presentinvention.

When the copy processing program 922 executes the copy suspensionprocessing in the execution mode of “Flush,” it reflects the updatejournal) of the primary volume 122 a up to the point in time that thecopy suspension processing was executed in the secondary volume 122 b,and thereafter changes the pair status to a Suspend-Operation status.The pair status immediately after the copy suspension processing is aSuspending status.

Since the journals up to the point in time that the copy suspensionprocessing was executed are read by the secondary storage system 120 band written into the secondary volume 122 b, the restoration finish time1205 of the copy management table 923 a shown in FIG. 36A will be thesame as the time that the copy suspension processing was executed;namely, “12:40.” The journal reception time 1303 b of the journal volumemanagement table 924 b of the secondary storage system 120 b will alsobe the same as the time that the copy suspension processing wasexecuted; namely, “12:40.”

The recovery point objective at this point in time is sought as follows.

Specifically, the copy processing program 922 determines whether thevalid flag 1304 b of the journal volume management table 924 b shown inFIG. 36C is “valid.” In this example, since the validity flag 1304 b is“valid,” the copy processing program 922 sets the journal reception time1303 b (i.e., “12:40”) of the journal volume management table 924 bshown in FIG. 36B as the recovery point objective in the consistencytime 1526 of the pair status table 1520 shown in FIG. 14D.

FIG. 37A to FIG. 37D are diagrams respectively showing the contents ofthe respective tables when the pair status acquisition processing isexecuted at a certain time in the remote copy system according to thefirst embodiment of the present invention. Specifically, FIG. 37A toFIG. 37D are diagrams respectively showing the contents of the copymanagement table 923, the journal volume management table 924 a, thejournal volume management table 924 b, and the pair status table 1520when the copy suspension processing in the executed mode of “Purge” isexecuted at 12:40 and the pair status acquisition processing is executedat 12:50 in the remote copy system according to the first embodiment ofthe present invention.

When the copy processing program 922 executes the copy suspensionprocessing in the execution mode of “Purge,” it discards the journalsremaining in the journal volume 122, and changes the pair status to aSuspend-Operation status.

Thus, the restoration finish time 1205 of the copy management table 923shown in FIG. 14A is earlier than the time (“12:34” in this example)that the copy suspension processing was executed. Since the journalshave been discarded, the validity flag 1304 b of the journal volumemanagement table 924 b in the secondary storage system 120 b is“invalid” and, therefore, the journal reception time 1303 b is also“invalid.”

The recovery point objective at this point in time is sought as follows.

Specifically, the copy processing program 922 determines whether thevalidity flag 1304 b of the journal volume management table 924 b shownin FIG. 37C is “valid.” In this example, since the valid flag 1304 b is“invalid,” the copy processing program 922 subsequently determineswhether the valid flag 1206 of the copy management table 923 shown inFIG. 14A is “valid.”

Here, since the validity flag 1206 is “valid,” the copy processingprogram 922 sets the restoration finish time 1205 (i.e., “12:33”) of thecopy management table 923 shown in FIG. 14A as the recovery pointobjective in the consistency time 1526 of the pair status table 1520shown in FIG. 14D.

FIGS. 38A-38D are diagrams respectively showing the contents of therespective tables when a failure occurs in the primary volume at acertain time in the remote copy system according to the first embodimentof the present invention. Specifically, FIGS. 38A-38D are diagramsrespectively showing the contents of the copy management table 923, thejournal volume management table 924 a, the journal volume managementtable 924 b, and the pair status table 1520 when a failure occurs in theprimary volume 122 a at 12:40 in the remote copy system according to thefirst embodiment of the present invention.

When the primary volume 122 a is subject to a failure, the pair status1204 of the copy management table 923 is changed to a “Suspend-Failure”status.

Here, since the journal volume 122 b of the secondary storage system 120b is not subject to a failure, the journals transferred to the secondaryjournal volume 122 b are reflected in the secondary volume 122 b even ifa failure occurs in the primary volume.

The recovery point objective at this point in time is sought as follows.

Specifically, the copy processing program 922 determines whether thevalid flag 1304 b of the journal volume management table 924 b shown inFIG. 38C is “valid.” In this example, since the validity flag 1304 b is“valid,” the copy processing program 922 sets the journal reception time1303 (i.e., “12:38”) of the journal volume management table 924 b shownin FIG. 14C as the recovery point objective in the consistency time 1526of the pair status table 1520 shown in FIG. 14D.

FIGS. 39A-39D are diagrams respectively showing the contents of therespective tables when a failure occurs in the secondary volume 122 b ata certain time in the remote copy system according to the firstembodiment of the present invention. Specifically, FIGS. 39A-39D arediagrams respectively showing the contents of the copy management table923, the journal volume management table 924 a, the journal volumemanagement table 924 b, and the pair status table 1520 when a failureoccurs in the secondary volume 122 b at 12:40 in the remote copy systemaccording to the first embodiment of the present invention.

Since a failure occurred in the secondary journal volume, the pairstatus is a Suspend-Failure status. The journals are reflected in thesecondary volume 122 b until just before the failure occurs in thesecondary journal volume 120 b.

The recovery point objective at this point in time is sought as follows.

Specifically, the copy processing program 922 determines whether thevalidity flag 1304 b of the journal volume management table 924 b shownin FIG. 39C is “valid.” In this example, since the valid flag 1304 b is“invalid,” the copy processing program 922 subsequently determineswhether the validity flag 1206 of the copy management table 923 shown inFIG. 14A is “valid.”

Consequently, since the validity flag 1206 is “valid,” the copyprocessing program 922 sets the restoration finish time 1205 (i.e.,“12:33”) of the copy management table 3602 d shown in FIG. 14A as therecovery point objective in the consistency time 1526 of the pair statustable 1520 shown in FIG. 14D.

FIGS. 40A-40D are diagrams respectively showing the contents of therespective tables when the pair status acquisition processing isexecuted at a certain time in the remote copy system according to thefirst embodiment of the present invention. Specifically, FIGS. 40A-40Dare diagrams respectively showing the contents of the copy managementtable 923, the journal volume management table 924 a, the journal volumemanagement table 924 b, and the pair status table 1520 at the time thepair deletion processing is executed at 13:00 and the pair statusacquisition processing is executed at 13:30 in the remote copy systemaccording to the first embodiment of the present invention.

Here, since the pairs as of 13:00 are deleted and the pair status is aSimplex status, the recovery point objective does not exist at thispoint in time.

As described above, according to the present embodiment, the copyprocessing program 922 of the storage system 120 receives a command fromthe host computer 110, and sets either the time attached to the latestjournal received by the secondary storage system 120 b or the timeattached to the journal that was last reflected in the secondary volumeas the valid recovery point objective. The storage operation program 302presents the recovery point objective to the user and, therefore, theuser is able to easily comprehend a valid recovery point objectivewithout having to give consideration to the occurrence of failures.

Second Embodiment

The second embodiment describes a case where the storage managementprogram 303 acquires the status of the secondary storage system 120 b,and presents, according to the acquired status, either the time attachedto the latest journal received by the secondary storage system 120 b orthe time attached to the journal reflected in the secondary volume 122 bas the recovery point objective. The main points that differ from thefirst embodiment are explained below.

FIG. 23 shows an example of the pair status table 1520 in the remotecopy system according to the second embodiment of the present invention.

As shown in FIG. 23, the pair status table 1520 of this embodimentincludes, in substitute for the consistency time 1526, a firstconsistency time 1527, a first validity flag 1528, a second consistencytime 1529, and a second validity flag 1530.

When the storage system 120 receives a pair status acquisition command,the restoration finish time 1205 of the copy management table 923 is setas the recovery point objective in the first consistency time 1527.

When the storage system 120 receives a pair status acquisitionprocessing, the journal reception time 1303 of the journal volumemanagement table 924 is set as the recovery point objective in thesecond consistency time 1529.

The value of the validity flag 1206 in the copy management table 923 andthe value of the validity flag 1304 in the journal volume managementtable 924 are respectively set in the first validity flag 1528 and thesecond validity flag 1530.

FIG. 24 is a flowchart explaining the consistency time settingprocessing X′ in the remote copy system according to the secondembodiment of the present invention.

As shown in FIG. 24, the copy processing program 922 executes theconsistency time setting processing X′, and sets prescribed values inthe respective fields of the pair status table 1520 (2400).Specifically, the copy processing program 922 sets the restorationfinish time 1205 of the copy management table 923 to the firstconsistency time 1527 of the pair status table 1520, and sets thevalidity flag 1206 to the first validity flag 1528. In addition, thecopy processing program 922 sets the journal reception time 1303 of thejournal volume management table 924 to the second consistency time 1529of the pair status table 1520, and sets the validity flag 1304 to thesecond validity flag time 1530.

Although the storage system 120 determined the valid recovery pointobjective in the foregoing first embodiment, in this embodiment, thehost computer 110 makes such determination. Specifically, in the firstembodiment, the copy processing program 922 of the storage system 120that received a pair status acquisition command from the storagemanagement program 303 based on the instructions of the storageoperation program 302 of the host computer 110 uses the validity flag1304 and the validity flag 1206 to determine a valid recovery pointobjective, returns the pair status table 2005 set with the recoverypoint objective to the storage management program 303, and the storagemanagement program 303 reports this as is to the storage operationprogram 302. In contrast, in this embodiment, the copy processingprogram 922 of the storage system 110 sends the information (contents ofthe copy management table 923 and the journal volume management table924) that it is retaining in accordance with the command from thestorage management program 303 of the host computer 110 to the storagemanagement program 303. The storage management program 303 determines avalid recovery point objective based on the command reply from thestorage system 120.

FIG. 25 is a flowchart explaining the copy group management tablesetting processing in the remote copy system according to the secondembodiment of the present invention.

Referring to FIG. 25, the storage management program 303 configuressettings in a prescribed field of the copy group management table 308(2500). This is the same as step 2000 c of FIG. 20C. Subsequently, thestorage management program 303 performs the consistency time settingprocessing X′ and acquires the consistency time (2002).

FIG. 26 is a flowchart explaining the consistency time settingprocessing X′ in the remote copy system according to the secondembodiment according to the present invention.

Referring to FIG. 26, foremost, the storage management program 303checks the pair status 1525 of the pair status table 1520 (2600). If thestorage management program 303 determines that the pair status 1525 is aSuspend-Operation status, a Suspending status, a Suspend-Failure status,or a Duplex status, it additionally checks the second valid flag 1530(2601).

If the storage management program 303 determines that the secondvalidity flag 1530 is “valid,” it returns the second consistency time1529 (2603). Meanwhile, if the storage management program 303 determinesthat the validity flag 1304 is “invalid,” it additionally checks thefirst validity flag 1528 (2602). If the storage management program 303determines that the validity flag 1206 is “valid,” it returns the firstconsistency time 1527 (2604). Meanwhile, if the storage managementprogram 303 determines that the valid flag 1206 is invalid, it returns“invalid” (2605).

Contrarily, if the pair status is Simplex status, Copying status, orDeleting status as a result of checking the pair status 1525 (2600), thestorage management program 303 returns “invalid” (2605).

In this embodiment, the storage management program 303 seeks therecovery point objective (consistency time) based on the pair statustable 1520. The first consistency time 1527 and the first valid flag1528 of the pair status table 1520′ respectively correspond to thejournal reception time 1303 and the valid flag 1304 of the journalvolume management table 924, and the second consistency time 1529 andthe second valid flag 1530 of the pair status table 1520′ respectivelycorrespond to the restoration finish time 1205 and the valid flag 1206of the copy management table 923. Thus, the calculation examples of therecovery point objective in this embodiment can be similarly explainedby reading the journal reception time 1303, the valid flag 1304, therestoration finish time 1205, and the valid flag 1206 of the firstembodiment as the corresponding items in the second embodiment.

As described above, according to the present embodiment, the storagemanagement program 303 of the host computer 110 sets, based on theinstructions of the storage operation program 302, either the timeattached to the latest journal received by the secondary storage system120 b or the time attached to the journal that was last reflected in thesecondary volume as the valid recovery point objective according to theinformation acquired from the storage system 120. The storage operationprogram 302 presents the set recovery point objective to the user and,therefore, the user is able to easily comprehend a valid recovery pointobjective without having to give consideration to the occurrence offailures.

Other Embodiments

Each of the foregoing embodiments is merely an exemplification forexplaining the present invention, and is not intended to limit thisinvention to such embodiments. The present invention may be worked invarious modes so as long as the working does not deviate from the gisthereof. For example, although the foregoing embodiments sequentiallyexplained the processing of the various programs, the present inventionis not limited thereto. Thus, the configuration may also be such thatthe processing sequence is switched or the processing is performed inparallel so as long as there is no contradiction in the processingresult.

The present invention can be broadly applied to a remote copy systemconfigured from computer systems installed respectively at a primarysite and a secondary site.

1. A remote copy system, comprising: a first host computer; a firststorage system operatively connected to the first host computer andincluding a first volume; a second host computer; and a second storagesystem operatively connected to the second host computer and the firststorage system, and including a second volume forming a pairrelationship with the first volume, wherein, when the first storagesystem receives one of write commands from the first host computer, thefirst storage system stores data accompanied with the write command inthe first volume, and creates a journal data to which a time informationis added based on a time stamp included with said one of the writecommands, wherein the second storage system receives the created journaldata from the first storage system, and updates the second volume basedon the received journal data, wherein the first host computer acquires avalid recovery point objective, depending on an operating status of thesecond storage system pertaining to either the latest time informationamong time information of each journal data that the second storagesystem received or the latest time information among time information ofeach journal data that updates the second volume, wherein the firststorage system includes: a first copy management table that manages thepair relationship; a first journal volume configured to temporarilystore the created journal data; and a first journal volume managementtable that manages the first journal volume, and wherein the secondstorage system includes: a second copy management table that manages thepair relationship; a second journal volume configured to temporarilystore the received journal data; and a second journal volume managementtable that manages the second journal volume, wherein the second copymanagement table retains a pair status indicating a status of the pairrelationship, a restore finish time indicating the time informationadded to the latest information among time information of each journaldata that updated the second volume, and a first validity flagindicating validity of the restore finish time; and wherein the secondjournal volume management table retains a journal reception timeindicating the time information added to the latest time informationamong time information of each journal data that the second storagesystem received, and a second validity flag indicating validity of thejournal reception time.
 2. The remote copy system according to claim 1,wherein, in response to a pair status acquisition command sent from thefirst host computer, the first storage system refers to the second copymanagement table and the second journal volume management table, setsthe valid recovery point objective, and sends the valid recovery pointobjective to the first host computer.
 3. The remote copy systemaccording to claim 1, wherein the first host computer provides theacquired valid recovery point objective to a user.
 4. A computer system,comprising: a first computer system including a host computer, a firststorage volume that stores I/O data from/to host computer, and a firstjournal volume that stores journal data created based on the I/O data,wherein time information is added to the journal data based on a timestamp included with one of write commands from the host computer tostore said journal data; and a second computer system including a secondjournal volume that stores the journal data sent from the first computersystem via a communication line, and a second storage volume that storesthe journal data based on time information pertaining to the journaldata; wherein the computer system further comprises: a management unitconfigured to manage an operating status of the second computer system;a determination unit configured to determine a valid recovery pointobjective, based on the operating status of the second computer system,pertaining to either the latest time information among the timeinformation of each journal data received in the second journal volumeor the latest time information among time information of each journaldata that updates the second volume, wherein the first computer systemincludes: a first copy management table that manages the pairrelationship; a first journal volume configured to temporarily store thecreated journal data; and a first journal volume management table thatmanages the first journal volume, and wherein the second computer systemincludes: a second copy management table that manages the pairrelationship; a second journal volume configured to temporarily storethe received journal data; and a second journal volume management tablethat manages the second journal volume, wherein the second copymanagement table retains a pair status indicating a status of the pairrelationship, a restore finish time indicating the time informationadded to the latest time information among time information of eachjournal data that updated the second volume, and a first validity flagthe restore finish time; and wherein the second journal volumemanagement table retains a journal reception time indicating the timeinformation added to the latest time information among time informationof each journal data that the second storage system received, and asecond validity flag indicating validity of the journal reception time.5. The computer system according to claim 4, wherein the management unitmanages the copy pair status of the second computer system.